Merlin
Cross-platform post-exploitation C2 written in Go, communicating over HTTP/1.1, HTTP/2, and HTTP/3.
Technical Architecture & Overview
Merlin is a Go-based C2 server and agent created by Russel Van Tuyl (Ne0nd0g). Its distinguishing feature is modern protocol support: agents speak HTTP/2 and HTTP/3 (QUIC) as well as HTTP/1.1, and peer-to-peer links between agents run over SMB, TCP, and UDP. Agents can change their JA3 hash and pad messages, and CERT-UA reported attackers using Merlin against Ukrainian state organizations in 2023.
Targeted Technical Use Cases
Testing detection coverage against QUIC and HTTP/2 C2 traffic during authorized engagements.
Evaluation & Trade-offs
Core Strengths
- +Agents support HTTP/3 (HTTP/2 over QUIC) in addition to HTTP/1.1 and HTTP/2.
- +Cross-platform agents from a single codebase.
- +Documentation site covering the server, agent, CLI, and modules.
Trade-Offs & Limitations
- -Use in real intrusions draws defender attention to its traffic.
Defensive Security Application
Blue team validation of protocol-level detection for modern C2 channels.
Frequently Asked Questions
What is Merlin?→
Merlin is a Go-based C2 server and agent created by Russel Van Tuyl (Ne0nd0g). Its distinguishing feature is modern protocol support: agents speak HTTP/2 and HTTP/3 (QUIC) as well as HTTP/1.1, and peer-to-peer links between agents run over SMB, TCP, and UDP. Agents can change their JA3 hash and pad messages, and CERT-UA reported attackers using Merlin against Ukrainian state organizations in 2023.
What is Merlin used for?→
Testing detection coverage against QUIC and HTTP/2 C2 traffic during authorized engagements.
What are the strengths of Merlin?→
- +Agents support HTTP/3 (HTTP/2 over QUIC) in addition to HTTP/1.1 and HTTP/2.
- +Cross-platform agents from a single codebase.
- +Documentation site covering the server, agent, CLI, and modules.
What are the limitations of Merlin?→
- +Use in real intrusions draws defender attention to its traffic.
How is Merlin used defensively?→
Blue team validation of protocol-level detection for modern C2 channels.